From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S966560AbbBCTpp (ORCPT ); Tue, 3 Feb 2015 14:45:45 -0500 Received: from resqmta-ch2-02v.sys.comcast.net ([69.252.207.34]:60879 "EHLO resqmta-ch2-02v.sys.comcast.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S966250AbbBCTpl (ORCPT ); Tue, 3 Feb 2015 14:45:41 -0500 Date: Tue, 3 Feb 2015 13:45:38 -0600 (CST) From: Christoph Lameter X-X-Sender: cl@gentwo.org To: Casey Schaufler cc: "Serge E. Hallyn" , Andy Lutomirski , Serge Hallyn , Serge Hallyn , Jonathan Corbet , Aaron Jones , "Ted Ts'o" , LSM List , "linux-kernel@vger.kernel.org" , Andrew Morton Subject: Re: [capabilities] Allow normal inheritance for a configurable set of capabilities In-Reply-To: <54D10A50.5030707@schaufler-ca.com> Message-ID: References: <54CFB9B8.8020701@schaufler-ca.com> <20150202180806.GE24351@ubuntumail> <54CFE3E8.2030402@schaufler-ca.com> <20150203155122.GD2923@mail.hallyn.com> <54D0F94D.3050704@schaufler-ca.com> <20150203172837.GC4748@mail.hallyn.com> <54D10A50.5030707@schaufler-ca.com> Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, 3 Feb 2015, Casey Schaufler wrote: > > (I wasn't going to ask bc I assumed not, but heck maybe you're bored > > on a desert island or snowed in and just looking for an excuse to hack :) > > Not at all bored, but I think this could be important. Ok here is a draft of a patch that follows these ideas. It also adds an ambient field and sets the field if a new capability CAP_AMBIENT_MASK is set. The perm calcualtion is as suggested by Serge. If CAP_AMBIENT_MASK is set the inheritable caps become the ambient ones. If it is not set then the ambient caps are copied from the parent. DRAFT --- not a working patch: Index: linux/include/linux/capability.h =================================================================== --- linux.orig/include/linux/capability.h 2015-02-03 13:25:03.000000000 -0600 +++ linux/include/linux/capability.h 2015-02-03 13:39:23.385424676 -0600 @@ -29,6 +29,7 @@ struct cpu_vfs_cap_data { __u32 magic_etc; kernel_cap_t permitted; kernel_cap_t inheritable; + kernel_cap_t ambient; }; #define _USER_CAP_HEADER_SIZE (sizeof(struct __user_cap_header_struct)) Index: linux/include/uapi/linux/capability.h =================================================================== --- linux.orig/include/uapi/linux/capability.h 2014-07-10 16:10:29.814424392 -0500 +++ linux/include/uapi/linux/capability.h 2015-02-03 13:26:13.231081452 -0600 @@ -351,8 +351,10 @@ struct vfs_cap_data { #define CAP_AUDIT_READ 37 +/* Set the current inheritable mask as the ambient inheritable mask */ +#define CAP_AMBIENT_MASK 38 -#define CAP_LAST_CAP CAP_AUDIT_READ +#define CAP_LAST_CAP CAP_AMBIENT_MASK #define cap_valid(x) ((x) >= 0 && (x) <= CAP_LAST_CAP) Index: linux/security/commoncap.c =================================================================== --- linux.orig/security/commoncap.c 2015-02-03 13:25:03.000000000 -0600 +++ linux/security/commoncap.c 2015-02-03 13:43:16.317859741 -0600 @@ -349,17 +349,24 @@ static inline int bprm_caps_from_vfs_cap CAP_FOR_EACH_U32(i) { __u32 permitted = caps->permitted.cap[i]; __u32 inheritable = caps->inheritable.cap[i]; + __u32 ambient = caps->ambient.cap[i]; /* * pP' = (X & fP) | (pI & fI) */ new->cap_permitted.cap[i] = (new->cap_bset.cap[i] & permitted) | - (new->cap_inheritable.cap[i] & inheritable); + (new->cap_inheritable.cap[i] & inheritable) | + (ambient & inheritable); if (permitted & ~new->cap_permitted.cap[i]) /* insufficient to execute correctly */ ret = -EPERM; + + if (capable(CAP_AMBIENT_MASK)) + new->cap_ambient.cap[i] = inheritable; + else + new->cap_ambient.cap[i] = ambient; } /* Index: linux/include/linux/cred.h =================================================================== --- linux.orig/include/linux/cred.h 2014-12-18 11:17:49.731948737 -0600 +++ linux/include/linux/cred.h 2015-02-03 13:37:32.701019201 -0600 @@ -122,6 +122,7 @@ struct cred { kernel_cap_t cap_permitted; /* caps we're permitted */ kernel_cap_t cap_effective; /* caps we can actually use */ kernel_cap_t cap_bset; /* capability bounding set */ + kernel_cap_t cap_ambient; /* Ambient inherited caps */ #ifdef CONFIG_KEYS unsigned char jit_keyring; /* default keyring to attach requested * keys to */